{"record":{"id":"0fba1632978cc8f7","repo":"t8y2/dbx","slug":"load-hive-truststore-w","errorCode":null,"errorMessage":"load Hive truststore: %w","messagePattern":"load Hive truststore: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":1073,"sourceCode":"\t\t\treturn nil, fmt.Errorf(\"read Hive CA certificate: %w\", err)\n\t\t}\n\t\tcustomRoots = x509.NewCertPool()\n\t\tif !customRoots.AppendCertsFromPEM(contents) {\n\t\t\treturn nil, errors.New(\"Hive CA certificate contains no certificates\")\n\t\t}\n\t}\n\ttrustStoreLocation := parameter(values, \"ssltruststore\")\n\tif trustStoreLocation != \"\" {\n\t\tif parameter(values, \"truststorepassword\") == \"\" && credentialProviderPath != \"\" {\n\t\t\treturn nil, errors.New(\"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure trustStorePassword explicitly for the native agent\")\n\t\t}\n\t\tcertificates, err := loadTrustStore(\n\t\t\ttrustStoreLocation,\n\t\t\tparameter(values, \"truststorepassword\"),\n\t\t\tparameter(values, \"truststoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive truststore: %w\", err)\n\t\t}\n\t\tif customRoots == nil {\n\t\t\tcustomRoots = x509.NewCertPool()\n\t\t}\n\t\tfor _, certificate := range certificates {\n\t\t\tcustomRoots.AddCert(certificate)\n\t\t}\n\t}\n\tconfig.RootCAs = customRoots\n\tif params.ClientCertPath != \"\" || params.ClientKeyPath != \"\" {\n\t\tif params.ClientCertPath == \"\" || params.ClientKeyPath == \"\" {\n\t\t\treturn nil, errors.New(\"Hive client certificate and key must be configured together\")\n\t\t}\n\t\tcertificate, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive client certificate: %w\", err)\n\t\t}\n\t\tconfig.Certificates = []tls.Certificate{certificate}","sourceCodeStart":1055,"sourceCodeEnd":1091,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L1055-L1091","documentation":"When truststore parameters are present (truststore location), the driver calls loadTrustStore to obtain root certificates and wraps any failure with this message. The %w preserves the underlying cause — bad path, wrong password, unsupported store type. It is thrown because TLS cannot be established without the trust anchors.","triggerScenarios":"Opening a Hive connection with truststore settings configured and loadTrustStore returns an error: unreadable store file, incorrect truststorepassword, unknown truststoretype, or corrupt store contents.","commonSituations":"Password rotated in the credential provider but not the config; JKS store supplied where PKCS12 expected (or vice versa); store path wrong after migration; store truncated during upload.","solutions":["Check the wrapped cause and verify the truststore file path exists and is readable","Verify truststorepassword matches the store and truststoretype matches its format (JKS/PKCS12)","Re-export or re-download a non-corrupt truststore from the Hive server's CA","If a CA PEM file is available instead, use sslCACertPath rather than a truststore"],"exampleFix":"// before\nvalues[\"truststorepassword\"] = \"oldpass\"\n// after\nvalues[\"truststorepassword\"] = os.Getenv(\"TRUSTSTORE_PASSWORD\")","handlingStrategy":"validation","validationCode":"if loc := values[\"truststore\"]; loc != \"\" {\n    if _, err := os.Stat(loc); err != nil {\n        return fmt.Errorf(\"truststore missing: %w\", err)\n    }\n    if values[\"truststorepassword\"] == \"\" {\n        return errors.New(\"truststorepassword required\")\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := tryConnect(); err != nil {\n    if strings.HasPrefix(err.Error(), \"load Hive truststore:\") {\n        // log wrapped cause, refresh password from secret store, retry once\n    }\n    return err\n}","preventionTips":["Keep truststore passwords in a secret manager, read at startup","Match truststoretype to the actual store format","Test truststore loading in CI with the same file deployed to prod","Regenerate stores as PKCS12 for best Go compatibility"],"tags":["tls","hive","truststore","config"],"backgroundTag":"tls-certificate-load-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}